Security firms confirm PHP2Shell breaches after patches

Three days after the PHP project shipped emergency fixes for two critical flaws known as PHP2Shell, the worst-case scenario of mass exploitation has not happened. The danger has not passed either. By late Friday, Palo Alto Networks ↗ 7.22% and Trail of Bits had confirmed compromises and post-exploitation activity tied to the bugs, TechCrunch reported. Researchers also warned that many systems around the world are still unpatched.telesurenglish.net

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution on any PHP installation that serves web requests, according to PHP's security advisory. The project urged users to upgrade immediately to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Both flaws are rated 9.2 out of 10 in severity.bitdefender.com+1

A broken embargo

The coordinated disclosure fell apart early. On October 20, the CVE IDs began circulating online, and PHP moved its release up by a day to 14:00 UTC on October 21, Bitdefender said. PHP says no technical details actually leaked. However, Chainguard published container images containing the fix more than six hours before the release, which broke the embargo. Amazon Amazon.com, Inc. ↘ 0.95% separately detected exploitation attempts as early as October 17.bitdefender.com+1

Cloudflare ↗ 7.29% CEO Matthew Prince said the company's network saw thousands of attempts in the 10 hours before the announcement. That rose to "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now".thenextweb.com

Websites go dark

Organizations around the world took systems offline as a precaution. In Japan, Prime Minister Sanae Takaichi urged site operators to patch. Nomura ↘ 0.66%, Mitsubishi UFJ Financial Group ↘ 1.59%, ANA and East Japan Railway temporarily halted some online services. The Wikimedia Foundation said it had "taken down a number of other systems as a precautionary measure until they can be safely patched". Orange ↘ 1.66% suspended access to certain services worldwide while it deployed fixes.world.storm.mg+2

AI's double edge

Researchers at Calif found the bugs during an AI-assisted audit run through an initiative with OpenAI and Wiz. Calif cautioned that "no model is simply capable of unearthing 'all bugs' with simple prompts".techcrunch.com

An October 22 advisory from Aquila I urged organizations to identify internet-facing PHP applications, check which versions they run and apply updates urgently.indianstartuptimes.com

Writing in Red Hot Cyber, Luigi Zullo argued that AI is shrinking the time between disclosure and exploitation. Exploits appeared days before the patches, he wrote, so companies now face "an actual impossibility of updating systems according to standard processes."redhotcyber.com